RE: Sox Poll results

 Welll, many people responded directly to me. Many dba's are going through this hassle in various forms and some are being regretfully emasculated to having squat for privileges... And I am not sure want to broadcast it... Of course this is just US dba's so its just the Canadians dba's that probably still work by the seat of their pants with everything balancing on them to go right.. (Don't really know- haven't been there in 4 years).

 I have had to sign so many agreements of confidentiality it ain't funny. Right now the procedure to enforce this are out of control as we have to manually record in 3 systems (and some systems are 10 page fill outs.. ) even for logging into these systems.. So some of you dbas-- don't worry, be happy! I'm sure when people see the waist of time it is...we will improve the system.

Cheers,
And thanks to all who responded,
Brian Spears

Kafka would be amused.

Conspiratorial fraud between senior management and auditing firms led directly to the Sarbanes-Oxley regulations passing.

Now, external audit reports by auditing firms are mostly transparent consulting cash generating projects that focus on making life difficult for IT departments. Not one single SEC investigation I am aware of has anything to do with unethical behavior by DBAs or development staff; yet most of the focus of SarBox audits is on locking development out of production by scaring senior management about who has the keys and encouraging them to believe they cannot trust their own employees.

<craft your own Mogens-like phrase about being glad to be in partial ownership of a consulting firm.>

Now, for what it is worth, I do support the notion that production DBAs should sign similar agreements of confidentiality and fiduciary responsibility as those signed by those in the payroll, human benefits, and finance departments. Most of the external audit reports I've seen try to claim that DBAs either do not understand the business or are not trustworthy, or both. If that is they case, your company is already toast anyway. Far too many companies and auditors are confused about what a DBA is and too lightly assign that title to folks who are at most database operators rather than administrators.

Regards,

mwf

-----Original Message-----
From: oracle-l-bounce_at_freelists.org [mailto:oracle-l-bounce_at_freelists.org]On Behalf Of Jared Still
Sent: Sunday, October 31, 2004 1:41 AM
To: bspears_at_limitedbrands.com
Cc: oracle-l_at_freelists.org
Subject: Re: Sox Poll

I don't have to request the system password, but do have to request the password for the application accounts on the servers.

We have personal logins with admin rights on the servers. The point of this is being able to audit who did what, and if someone has the password, who it is/was.

Jared

On Fri, 29 Oct 2004 10:39:00 -0400, Spears, Brian <bspears_at_limitedbrands.com> wrote:
>
> Ok, let me put it clearer... DBA's not beening allowed to have the
> system password. They must request it from a separate group to do
> changes. I am hearing of other dba's having to do this. I know we
> haven't only because

no
> one suggested it yet. We are having to do some real interesting
contortions
> to get stuff done.
>
> Brian
>
> -----Original Message-----
> From: oracle-l-bounce_at_freelists.org
> [mailto:oracle-l-bounce_at_freelists.org]
> On Behalf Of Spears, Brian
> Sent: Friday, October 29, 2004 10:06 AM
> To: oracle-l_at_freelists.org
> Subject: Sox Pole
>
> Just wondering if Sarbanes Oxley has reduced people to getting
> permission for the system password each time from Operations to be
> able to sign into the production databases? Some real crazy stuff
> coming out of this.
>
> Brian
>
> --
> http://www.freelists.org/webpage/oracle-l
>
> --
> http://www.freelists.org/webpage/oracle-l
>

--
Jared Still
Certifiable Oracle DBA and Part Time Perl Evangelist
--
http://www.freelists.org/webpage/oracle-l


--
http://www.freelists.org/webpage/oracle-l

--
http://www.freelists.org/webpage/oracle-l